I need to author a SharePoint solution that provides management of
security privileges within my organization. This is to include user requests
for privileges, approval workflow, automated and manual implementation of privilege
changes, reporting of privileges as recorded for comparison to the as-is state (auditing:
did someone make an error or bypass the process), and a workflow to obtain
approvals of privileges as recorded (auditing: you said to give these people
these privileges, do they still need them?).
To best deal with the challenges this presents, and avoid
issues with previous attempts at a solution, I have developed a three list
solution to be implemented in SharePoint. I have a list of security Objects
(e.g. network folder, database, external application), a child list of Privileges
for each object (one to many), and a Log that records all granting and revocation
of security privileges. Security objects can be nested, e.g. a table contained
in a database. Therefore the Object list has a column for parent object IDs (and
possible regression loop that is an acceptable risk). A diagram of the
relationships is attached.
As part of a preliminary solution, how feasible is it to
develop an InfoPath form that will be used for requesting and changing a user’s
privileges where the list of objects and object privileges will change over
time? In a perfect world;
-
When the form is opened it will query the Object
list and present all of the active objects (haven’t been decommissioned) and
query the privileges list to display privileges associated with each object (privileges
would be hidden/collapsed for readability).
-
After a user is selected the form will query the
Log and, where there is a match, expand the appropriate object sections and
check existing privileges.
-
Allow the user to edit the form by checking and
unchecking privileges for each object.
-
Upon submission, a workflow will require each
object’s business owner to approve changes. Approved changes will be either implemented
by the workflow and logged or, when automation is not possible, generate a
workflow step for a system administrator to implement. In the case of a system
administrator, upon completion of their workflow step (confirming that they
have made the change) an entry will be logged.
The form will have to be dynamically generated as the
objects and privileges could change. E.g. since the time an employee was hired
and first granted privileges two systems were retired, one system added, and
privileges changed on one other system. We do not want to have to manually
update the form with every change to the environment.
I am looking at using the Nintex workflow tool, specifically
for Lazy Approval and its ability to modify AD. I have licenses for qRules and
DBXL.
